huntrule

Windows Process Creation: Node.js Executions from Adobe Creative Cloud

Flags Windows executions of Adobe Creative Cloud’s bundled node.exe, excluding typical JS resource paths.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Max Altgelt (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-04-06
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies when a Windows process is launched using Node.js packaged within the Adobe Creative Cloud installation. Attackers can use bundled runtimes to execute scripts from within legitimate software directories, helping blend execution into normal system activity. The detection relies on process creation telemetry that captures the executable path and command line, specifically matching the Creative Cloud node.exe location while excluding command lines that indicate Adobe Creative Cloud JavaScript resource usage.

Reporting behind it

Related detections9 linkedT1059.007 — drag to rearrange
Suspicious Hidden PowerShell Spawned by Script Host via process_creation
Suspicious Node.js Execution of nvidia.js Script via cmd (via process_creation)
Suspicious Script Host Spawning PowerShell Download Cradle (via process_creation)
Suspicious .NET LOLBin Execution via CasPol or RegAsm
Suspicious PowerShell Spawned by Windows Script Host during Scarlet Goldfinch Infection (via process_creation)
Suspicious Windows Script Host Execution of JavaScript from Temporary Archive Extraction Folder (via process_creation)
Suspicious Whoami Discovery Spawned by Windows Script Host via Process Creation (via process_creation)
Suspicious Node.js Execution from User AppData Directory (via process_creation)
Malicious Shai-Hulud npm Worm Marker via SHA1HULUD Process Name (via process_creation)
Windows Process Creation: Node.js Executions from Adobe Creative Cloud
Pivot detection · T1059.007 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.